Skip to content

docs: remove the package version status 403 response - #73

Draft
nishantms wants to merge 1 commit into
mainfrom
nishantms/package-version-status-drop-403
Draft

docs: remove the package version status 403 response#73
nishantms wants to merge 1 commit into
mainfrom
nishantms/package-version-status-drop-403

Conversation

@nishantms

Copy link
Copy Markdown
Contributor

Summary

Removes the 403 response from the package version status endpoint. It documented the rollout gate, which is being removed in npm/registry-frontdoor#1198.

Part of: https://github.com/github/npm/issues/15578

Why

403 on this endpoint only ever meant "package version status is not enabled for this package". It was never an authorization signal. A caller who cannot read a package has always received 404, deliberately indistinguishable from a version that does not exist, so the response never reveals whether a package the caller cannot see exists. That 404 behaviour is unchanged.

Once the feature flag is gone the endpoint cannot return 403 at all, so documenting it would be misleading.

What Changed

Change Why
Removed the "403" entry from the operation's responses No longer reachable
Removed the PackageVersionStatusForbidden component Only referenced by that entry

Remaining responses: 200, 400, 401, 404, 429, 500, 503.

503 is unaffected

npm/registry-frontdoor#1199 removes the transitional guard that was this route's only self-raised 503, but the lookup path still forwards an upstream 503, so PackageVersionStatusUnavailable stays accurate and is left in place.

Merge order

Land this after npm/registry-frontdoor#1198 is deployed. Merging earlier leaves a window where the endpoint can still return a 403 that is no longer documented.

Risk Assessment

Low. Documentation only, describing a response that is being removed from the service.

@github-actions

Copy link
Copy Markdown

🚀 Preview deployed!

You can view the preview of your changes here: https://npm-6bf648fb67-61146453.drafts.github.io/

This preview will be updated automatically when you push new commits to this PR.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant